---
id: "CVE-2023-32321"
kind: "vulnerability"
aliases: ["CVE-2023-32321", "GHSA-446m-hmmm-hm8m"]
title: "Ckan remote code execution and private information access via crafted resource ids"
severity: "critical"
cvss: 9.8
epss: 0.01684
exploited: false
status: "open"
category: "package"
products: [{"name": "ckan", "fixed": ["2.9.9"], "affected": "< 2.9.9", "ecosystem": "pypi"}, {"name": "ckan", "fixed": ["2.10.1"], "affected": "= 2.10.0", "ecosystem": "pypi"}, {"name": "okfn ckan", "fixed": ["2.9.9"], "affected": ">= 2.9.0, < 2.9.9", "ecosystem": "vendor"}, {"name": "okfn ckan", "fixed": [], "affected": "= 2.10.0", "ecosystem": "vendor"}]
ecosystems: ["pypi", "vendor"]
tags: ["ckan", "cwe-20", "package", "python", "self-hosted"]
not_affected_if: ["fixed-version", "read-only-portal"]
published_at: "2023-05-24T17:24:56+00:00"
first_seen_at: "2026-10-27T16:30:45+00:00"
updated_at: "2026-10-27T16:33:07+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-446m-hmmm-hm8m", "first_seen_at": "2026-10-27T16:30:45+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-32321", "first_seen_at": "2026-10-27T16:33:07+00:00"}]
---

# Ckan remote code execution and private information access via crafted resource ids

CKAN's resource_create and package_update actions accept crafted resource ids that write uploaded files to arbitrary locations, and Beaker's file session store unpickles data unsafely, so a dataset editor can reach remote code execution. The same flaw lets users read and overwrite resources they cannot access.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:ckan affected < 2.9.9 fixed 2.9.9
- pypi:ckan affected = 2.10.0 fixed 2.10.1
- vendor:okfn ckan affected >= 2.9.0, < 2.9.9 fixed 2.9.9
- vendor:okfn ckan affected = 2.10.0 fixed ?

## How to check

- Check the installed CKAN version with `pip show ckan` and compare it to the fixed releases
- Look at `session.type` in the CKAN config; if it is `file` with Beaker, the remote code execution path is open

## Fix

- Upgrade CKAN to `2.9.9` or `2.10.1` or later
- For older 2.9 installs, apply the upstream patches from the GHSA advisory

## Timeline

- 2026-10-27T16:30:45+00:00 ghsa https://github.com/advisories/GHSA-446m-hmmm-hm8m
- 2026-10-27T16:33:07+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-32321

## From the sources

CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan which may lead to remote code execution. An arbitrary file write in `resource_create` and `package_update` actions, using the `ResourceUploader` object.  Also reachable via `package_create`, `package_revise`, and `package_patch` via calls to `package_update`. Remote code execution via unsafe pickle loading, via Beaker's session store when configured to use the file session store backend. Potential DOS due to lack of a length check on the resource id. Information disclosure: A user with permission to create a resource can access any other resource on the system if they know the id, even if they don't have access to it. Resource overwrite: A user with permission to create a resource can overwrite any resource if they know the id, even if they don't have access to it. A user with permissions to create or edit a dataset can upload a resource with a specially crafted id to write the uploaded file in an arbitrary location. This can be leveraged to Remote Code Execution via Beaker's insecure pickle loading. All the above listed vulnerabilities have been fixed in CKAN 2.9.9 and CKAN 2.10.1. Users are advised to upgrade. There are no known workarounds for these issues.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_